Connecting ServiceNow

Connect a ServiceNow instance so Eraser can draw architecture diagrams from the configuration items (CIs) and relationships in your CMDB. Eraser reads the instance as an integration user you create yourself, and that user holds only read roles.

Everything below starts from Settings → Data Sources in Eraser – keep that tab open, since you’ll return to it to copy values into ServiceNow.

Quick overview

1. Enter your instance (how-to)
2. Create the integration user (how-to)
3. Configure Google OIDC (how-to)
4. Connect the instance (how-to)

What Eraser gets access to

The integration user holds three roles: sn_cmdb_user, service_viewer, and snc_read_only. Together they allow reading configuration items, their relationships, and the application services they belong to – nothing else.

No password or API key is exchanged. Eraser signs in with a short-lived token issued by Google, and your instance accepts it only because you register Google as a trusted provider for your team in step 3. A token issued for any other Eraser team is refused.

Eraser checks the user’s roles before it accepts the connection and before every scan, and refuses anything broader: a user holding any other role is rejected.

1. Enter your instance

Open Settings → Data Sources and pick ServiceNow – from the list of data sources, or from Add connection once one is connected. Enter your instance’s hostname, such as pulsequeue.service-now.com. The buttons in the next two steps open pages on that instance.

2. Create the integration user

Choose Open a new user in ServiceNow and create a user with the Email Eraser shows and Web service access only ticked. The form usually opens with both already filled in. Choose Submit.

Open the new user and add three roles on its Roles tab: sn_cmdb_user, service_viewer, and snc_read_only.

3. Configure Google OIDC

Eraser gives you the audience your instance should accept:

Choose Open Application Registry in ServiceNow, then New and Configure an OIDC provider to verify ID tokens. Set Client ID to the Audience from Eraser.

For its OIDC provider configuration, use Google’s metadata URL, https://accounts.google.com/.well-known/openid-configuration, map the email claim to the user’s Email field, and turn off JTI verification – Google’s tokens don’t carry a JTI claim.

4. Connect the instance

Back in Eraser, you can add a Filter: a ServiceNow encoded query that limits which CIs are imported, such as sys_class_name=cmdb_ci_server. Leave it empty to import every CI the user can read. Retired CIs are always skipped.

Choose Verify and connect, and Eraser runs its first scan.

After connecting

Each connection appears in Settings → Data Sources, showing the instance and when it last synced.

• Rescan reads the CMDB again. There is no scheduled background scan – Eraser reads your instance when you ask it to.
• Active lets Eraser scan the instance and use it as context in AI chat. Inactive stops both, without discarding the connection.
• Reconnect checks the setup again after you fix it in ServiceNow, keeping the connection’s history.
• Remove from Eraser disconnects and forgets the instance.

Removing a connection does not change anything in ServiceNow. To revoke access completely, also deactivate the integration user.

Once a connection is active, anyone on the team can reference it in AI chat to generate architecture diagrams – see Cloud diagrams.

Troubleshooting